Abliterated vs uncensored: what each edit removes

What an abliterated model has removed

The method comes from one 2024 paper. Arditi et al., “Refusal in Language Models Is Mediated by a Single Direction”, showed that across 13 open chat models the decision to refuse travels along one direction in the residual stream. Erase that direction and the model stops refusing. Add it back and a model refuses harmless requests.

In plain words, a transformer keeps one running vector per token, the residual stream, and every layer reads from it and adds to it. Run the model on a few hundred harmful prompts and a few hundred harmless ones, record that vector at one layer and one token position, and subtract the two averages. The difference of means is the refusal direction.

Abliteration then edits the weights. Every matrix that writes into the residual stream, the attention output projections and the MLP output projections, has the refusal direction projected out of it. After the edit no layer can write along that direction, so the model never forms the refuse signal. No training run, no new data, minutes on one GPU, and every other weight stays as it was. The model keeps its knowledge, its formatting and its tool calling.

The paper describes two ways to apply it. The first subtracts the direction from the activations at inference time, which needs a hook in the serving code on every request. The second bakes the same subtraction into the weights once, which is what a downloadable abliterated checkpoint is and what this catalog serves. Both give the same behavior: where the stock model writes a refusal sentence and stops, the abliterated model starts on the answer. The system prompt still works, because instruction following was never on the removed direction.

Two things follow. First, the edit is not free. The direction is never perfectly isolated, so a little of the model’s other behavior goes with it, and the output distribution moves. The Heretic README publishes the two numbers that matter for several public Gemma 3 12B abliterations, read on 2026-10-24: refusals on 100 harmful prompts and KL divergence from the original on harmless prompts. One community build scored 3/100 refusals at KL 0.45, another 3/100 at KL 1.04. So a few refusals survive, and the second build drifted more than twice as far from the original to reach the same count. Second, the name varies. Qwen3.8 27B Obliterated is the same edit under a different label; the catalog tags it abliterated.

What an uncensored fine-tune changes

An uncensored fine-tune leaves the refusal direction in the weights and trains the model not to use it. The author takes an instruction dataset, filters out every row where the answer is a refusal, or writes a dataset of their own, and runs supervised fine-tuning, sometimes followed by preference training. The result answers because it learned to; the ability to refuse is still in the weights.

That edit touches the whole output distribution. Tone, length, persona and how closely the model follows a system prompt all move with the training data. The cost is GPU hours or days instead of minutes, and the gain is a different voice. Every roleplay tune in this catalog is this kind of build (70 ids carry the roleplay tag on 2026-10-24), and a persona that holds for 200 turns is something no weight projection gives you.

Two full fine-tunes on the list publish their training notes on their model cards: Dolphin Mistral 24B Venice Edition from Cognitive Computations and Hermes 4 405B from Nous Research. Their output prices today are $9.00 and $6.00 per million tokens, read from the catalog at render.

An id that ends in -uncensored names the result. Behind it can sit a fine-tune, a merge of several tunes, or an abliteration the author did not label. The id tells you the build answers; the daily real-model check tells you it still answers the same way it did yesterday.

Heretic and derestricted: abliteration with the damage measured

Two newer labels are abliteration with the side effects measured and minimized, and the catalog tags both abliterated.

Heretic is an open-source tool that runs the whole procedure without configuration. It computes a refusal direction per layer, then lets a TPE optimizer search the ablation parameters, scoring each candidate on two numbers at once: refusals on harmful prompts and KL divergence from the original on harmless ones. Its direction index is a float, so it can interpolate between two layers’ directions instead of picking one. A build with Heretic in its name is, by community convention, one that went through that tool.

Derestricted is the label on builds made with norm-preserving biprojected abliteration, a refinement by Jim Lai (grimjim). The refusal direction is first made orthogonal to the harmless directions, so cutting it does not cut shared concepts. It is then removed only from the direction of each weight row, and the original magnitudes are put back. The GLM-4.6-Derestricted model card on Hugging Face, read on 2026-10-24, states the aim as removing refusals without the drop in reasoning that a plain projection causes, and lists the plain abliteration’s change to weight magnitudes as the cause of that drop.

Today’s catalog lists 11 such builds. Each row links to its model page; prices are read live.

Prices per million tokens, read from the live catalog on 2026-10-24.

Measured on this catalog today

The counts below come from the tags on the live catalog, read at render on 2026-10-24. Of the 135 uncensored builds listed, 22 carry the abliterated tag: 11 say abliterated or obliterated in the id and 11 are the Heretic, derestricted and unshackled builds above. 29 are uncensored builds with no roleplay or security tag, 70 are roleplay tunes and 4 are security builds.

The daily real-model check sends one fixed prompt to every model and records whether the answer still matches. The run from October 24, 2026 at 20:47 UTC covers 133 of these builds: 125 answered as before, 0 changed and 8 are not checked yet. The per-model verdicts are on the proof page, with a CSV.

Price follows the individual build, and two edits of the same base can sit far apart. A month of 20M input and 5M output tokens, a busy chat client or one coding agent, comes to $27.50 on GLM-5.3 Flash Abliterated, $97.50 on GLM-5.3 Abliterated and $10.37 on GLM-5.3 Uncensored, each multiplied out from the per-million rates in the tables below on 2026-10-24. Pick the edit for the behavior you need, then compare the rows of that kind.

Abliterated in the id

Uncensored builds, method not named

The full model list adds the roleplay tunes and the security builds, with context windows and wire formats.

Which kind to pick

The edit decides the fit. An abliteration keeps the base model and drops the refusals; a tune replaces the voice. Three cases cover most readers.

For a chat client

In SillyTavern, Janitor AI or any client that runs a persona, pick a roleplay tune when the character and the pacing matter more than the base model’s knowledge. Pick an abliterated build when you want the stock model’s voice and range without the refusals, for example DeepSeek V4.1 Flash Abliterated or GLM-5.3 Flash Apex Abliterated with its 1M-token context. Check the context column on the model list before a long chat: the older Llama 3 abliterations stop at 8K tokens, the community Gemma 4 and Qwen3.5 builds carry 256K. 3 builds are both: an abliteration with a roleplay tune on top, such as Gemma 4 26B-A4B ChimeraX Heretic. The ranked list by the daily check and price is in the best uncensored LLM by API in 2026.

For coding

Take an abliterated build of a strong coding base. A tune moves the output distribution, and in code that shows up as a different style, different defaults and more drift from the base’s training. An abliteration keeps the base’s coding ability and its tool calling. GLM-5.3 Flash Abliterated, GLM-5.3 Abliterated and MiMo V2.6 Flash Abliterated are the candidates on the list today; GLM-5.3 Flash Code Uncensored is the one coding build that names the result instead. Point OpenCode or Cline at the base URL per the docs and set the id.

For security work

The security builds are set up for offensive-security and malware-analysis questions, under the acceptable-use terms. For a general model that also handles a red-team task, an abliterated build of a current base does it without a jailbreak prompt to maintain; that case is the subject of AI with no restrictions.

Switching costs one line

Every build answers the same OpenAI-format endpoint on the same key, so testing all three kinds on one prompt is a loop over ids. Read the three answers for the two things the edit changes: whether the model starts on the answer or on a refusal, and how far the voice sits from the stock model’s. The abliteration should read like the base; the tune should read like its author’s dataset. Each answer carries its settled charge in the x-uplink-cost header, so the loop also prices the three builds on your own prompt.

What the id tells you, and what it does not

• abliterated, obliterated: the refusal direction was projected out of the weights. Same edit, two spellings.
• heretic, derestricted: abliteration with the refusal count and the KL divergence measured during the build.
• uncensored: the result. The method is on the model card when the author published one, and the daily check covers the rest.
• a roleplay name on an abliterated base: both edits, in order. The abliteration removed the refusals, the tune set the voice.
• jailbroken: not a build. A jailbreak is a prompt that steers a stock model around its refusal direction, and it stops working when the prompt changes. None of the ids on this page need one.

A build can leave the catalog, and the tables on this page skip an id that has left. A build that starts answering differently shows up as “changed” on the proof page the next day. The model page for each id carries its own verdict.

Questions